Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
CVE-2024-23900 - Medium Severity Vulnerability
Multi-configuration (matrix) project type.
Library home page: https://wiki.jenkins-ci.org/display/JENKINS/Matrix+Project+Plugin
Path to dependency file: /test/pom.xml
Path to vulnerable library: /canner/.m2/repository/org/jenkins-ci/plugins/matrix-project/1.14/matrix-project-1.14.jar
Dependency Hierarchy: - :x: **matrix-project-1.14.jar** (Vulnerable Library)
Found in HEAD commit: 3abfb254ea347629c1aed893510d133a3831c30e
Found in base branch: master
Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
Publish Date: 2024-01-24
URL: CVE-2024-23900
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-23900
Release Date: 2024-01-24
Fix Resolution: org.jenkins-ci.plugins:matrix-project:822.824.v14451b_c0fd42
Step up your Open Source Security Game with Mend here